Precedence
Per-account policy wins over per-capability policy, which wins over the default.
Disabled
A disabled account is excluded from planning. A plan that targets it is rejected before anything runs.
Approval
An approval policy suspends the run at that step. The rest of the plan waits; it does not run ahead of the decision.